CVE-2026-77993: Page Builder CK Reflected XSS Vulnerability

CVE-2026-77993 Overview

CVE-2026-77993 is a reflected cross-site scripting (XSS) vulnerability in the Joomla extension Page Builder CK developed by joomlack.fr. Versions prior to 3.6.5 fail to sanitize the iscontenttype parameter, allowing attackers to inject JavaScript that executes in the browser of any user who follows a crafted link. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction but no authentication, making phishing-style delivery the primary attack path against site administrators and visitors.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions in the Joomla context.

Affected Products

Joomla Page Builder CK extension versions prior to 3.6.5
Joomla CMS sites with the Page Builder CK extension installed
Vendor: joomlack.fr

Discovery Timeline

2026-08-24 - CVE-2026-77993 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77993

Vulnerability Analysis

The vulnerability is a reflected XSS in the Page Builder CK Joomla extension. The iscontenttype request parameter is reflected into the rendered HTML response without proper output encoding or input sanitization. An attacker can craft a URL that includes JavaScript payloads in this parameter and deliver it through phishing, forum posts, or malicious redirects.

When a victim loads the crafted URL, the injected script runs in the origin of the vulnerable Joomla site. If the victim holds an administrative session, the attacker can perform authenticated actions on their behalf, including creating users, modifying content, or installing malicious extensions. For anonymous visitors, the payload can redirect traffic, harvest form data, or stage further browser-based attacks.

Root Cause

The extension does not neutralize special characters in the iscontenttype parameter before reflecting the value into the HTTP response. The absence of context-aware output encoding and a Content Security Policy allows arbitrary script content to be interpreted as executable JavaScript.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting a vulnerable endpoint of Page Builder CK with a script payload placed in the iscontenttype parameter. Delivery relies on social engineering, typically an email or chat message enticing the target to click the link. See the JoomlaCK Official Site for extension details.

No verified public exploit code is available for this issue. The vulnerability class follows standard reflected XSS mechanics: parameter reflection without encoding.

Detection Methods for CVE-2026-77993

Indicators of Compromise

Web server access logs containing requests with iscontenttype parameter values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Unexpected outbound requests from browsers of authenticated Joomla administrators immediately after clicking external links.
New or modified Joomla administrator accounts, extensions, or template files without a matching change ticket.

Detection Strategies

Deploy a web application firewall rule that flags reflected XSS patterns in query parameters targeting Page Builder CK endpoints.
Correlate HTTP referrer, user-agent, and session identifiers to detect administrators loading URLs sourced from external domains.
Alert on Joomla audit log entries showing privileged actions performed within seconds of a suspicious inbound request.

Monitoring Recommendations

Enable verbose logging on the Joomla com_pagebuildck component and forward logs to a centralized SIEM for parameter-level inspection.
Monitor for spikes in 200-response requests carrying encoded angle brackets or event handler keywords.
Track browser Content Security Policy violation reports if CSP is deployed in report-only mode.

How to Mitigate CVE-2026-77993

Immediate Actions Required

Upgrade Page Builder CK to version 3.6.5 or later on all Joomla installations.
Invalidate active administrator sessions and rotate credentials for any account that may have followed suspicious links.
Review Joomla audit logs for unauthorized configuration changes since the extension was installed.

Patch Information

The vendor has released Page Builder CK version 3.6.5 which addresses the reflected XSS in the iscontenttype parameter. Administrators should obtain the update from the JoomlaCK Official Site and apply it through the Joomla extension manager. Verify the installed version under Extensions > Manage after the update completes.

Workarounds

Deploy a WAF signature that blocks requests containing script tags, event handlers, or javascript: schemes in the iscontenttype parameter.
Enforce a strict Content Security Policy that disallows inline scripts on Joomla front-end and administrator pages.
Restrict administrator access to the Joomla backend by IP allowlist to reduce exposure of privileged sessions to reflected payloads.

bash

# Example Apache mod_security rule blocking script payloads in iscontenttype
SecRule ARGS:iscontenttype "@rx (?i)(<script|javascript:|onerror=|onload=)" \
    "id:1026077993,phase:2,deny,status:403,log,msg:'CVE-2026-77993 XSS attempt blocked'"